Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

China: NPC requests public comments on second deliberated draft PIPL and draft data security law

The National People's Congress ('NPC') released, on 29 April 2021, the second deliberated drafts of the Personal Information Protection Law ('PIPL') and the Data Security Law and has requested public comments on the same. In particular, the second draft of the PIPL, among other things, expands on the right to withdraw consent, requiring that personal information processors provide a convenient method of withdrawing consent, noting that the withdrawal of consent by an individual does not affect the personal information processed before the withdrawal. In addition, the second draft of the PIPL addresses personal information of deceased individuals, specifically, highlighting that the exercise of their rights can be executed by close relatives. Furthermore, the second draft of the PIPL introduces requirements for internet platform services namely to:

  • establish an independent organisation mainly composed of external members;
  • cease providing services to products or service providers on the platform that hand personal information in serious violation of laws and administrative regulation; and
  • regularly publish reports on social responsibility for personal information protection and accept social supervision.

On the other hand, the second draft of the Data Security Law requires the state to, among other things, establish a data classification and hierarchical protection system and categorise, as well as categorise data protection requirements based on the importance of the data. In addition, the second draft of the Data Security Law clarifies that the provision of the Cybersecurity Law applies to the security management of data collected or produced by critical information infrastructure operators inside mainland China.

Public comments can be submitted until 28 May 2021.

You can read and submit public comments for the second draft PIPL here and second draft data security Law here, both only available in Chinese.